From: Guillaume Nault <g.nault@alphalink•fr>
To: Eric Biggers <ebiggers3@gmail•com>
Cc: syzbot <syzbot+c8e66da874feb11aaca6@syzkaller•appspotmail.com>,
davem@davemloft•net, kuznet@ms2•inr.ac.ru,
linux-kernel@vger•kernel.org, netdev@vger•kernel.org,
syzkaller-bugs@googlegroups•com, yoshfuji@linux-ipv6•org,
Paolo Abeni <pabeni@redhat•com>
Subject: Re: KASAN: out-of-bounds Read in ip6_xmit
Date: Tue, 15 May 2018 15:06:26 +0200 [thread overview]
Message-ID: <20180515130626.GA1389@alphalink.fr> (raw)
In-Reply-To: <20180509044525.GD711@sol.localdomain>
On Tue, May 08, 2018 at 09:45:25PM -0700, Eric Biggers wrote:
> On Sun, Jan 28, 2018 at 11:24:01AM -0800, syzbot wrote:
> > Hello,
> >
> > syzbot hit the following crash on net-next commit
> > 6bb46bc57c8e9ce947cc605e555b7204b44d2b10 (Fri Jan 26 16:00:23 2018 +0000)
> > Merge branch 'cxgb4-fix-dump-collection-when-firmware-crashed'
> >
> > Unfortunately, I don't have any reproducer for this crash yet.
> > Raw console output is attached.
> > compiler: gcc (GCC) 7.1.1 20170620
> > .config is attached.
> >
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+c8e66da874feb11aaca6@syzkaller•appspotmail.com
> > It will help syzbot understand when the bug is fixed. See footer for
> > details.
> > If you forward the report, please keep this part and the footer.
> >
> > ==================================================================
> > BUG: KASAN: out-of-bounds in ip6_dst_idev include/net/ip6_fib.h:192 [inline]
> > BUG: KASAN: out-of-bounds in ip6_xmit+0x1f76/0x2260
> > net/ipv6/ip6_output.c:264
> > Read of size 8 at addr ffff8801bcc8cc18 by task syz-executor2/11459
> >
> > CPU: 0 PID: 11459 Comm: syz-executor2 Not tainted 4.15.0-rc9+ #212
> > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> > Google 01/01/2011
> > Call Trace:
> > __dump_stack lib/dump_stack.c:17 [inline]
> > dump_stack+0x194/0x257 lib/dump_stack.c:53
> > print_address_description+0x73/0x250 mm/kasan/report.c:252
> > kasan_report_error mm/kasan/report.c:351 [inline]
> > kasan_report+0x25b/0x340 mm/kasan/report.c:409
> > __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430
> > ip6_dst_idev include/net/ip6_fib.h:192 [inline]
> > ip6_xmit+0x1f76/0x2260 net/ipv6/ip6_output.c:264
> > inet6_csk_xmit+0x2fc/0x580 net/ipv6/inet6_connection_sock.c:139
> > l2tp_xmit_core net/l2tp/l2tp_core.c:1096 [inline]
> > l2tp_xmit_skb+0x105f/0x1410 net/l2tp/l2tp_core.c:1191
> > pppol2tp_sendmsg+0x470/0x670 net/l2tp/l2tp_ppp.c:341
> > sock_sendmsg_nosec net/socket.c:630 [inline]
> > sock_sendmsg+0xca/0x110 net/socket.c:640
> > ___sys_sendmsg+0x767/0x8b0 net/socket.c:2046
> > __sys_sendmsg+0xe5/0x210 net/socket.c:2080
> > SYSC_sendmsg net/socket.c:2091 [inline]
> > SyS_sendmsg+0x2d/0x50 net/socket.c:2087
> > entry_SYSCALL_64_fastpath+0x29/0xa0
>
> No reproducer and last occurred 58 days ago (on commit f44b1886a5f876c8).
> Probably was fixed by commit b954f94023dcc61:
>
Indeed, this commit certainly applies to this report too. Thanks a lot
for looking into this.
prev parent reply other threads:[~2018-05-15 13:06 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-28 19:24 KASAN: out-of-bounds Read in ip6_xmit syzbot
2018-05-09 4:45 ` Eric Biggers
2018-05-15 13:06 ` Guillaume Nault [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180515130626.GA1389@alphalink.fr \
--to=g.nault@alphalink$(echo .)fr \
--cc=davem@davemloft$(echo .)net \
--cc=ebiggers3@gmail$(echo .)com \
--cc=kuznet@ms2$(echo .)inr.ac.ru \
--cc=linux-kernel@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=syzbot+c8e66da874feb11aaca6@syzkaller$(echo .)appspotmail.com \
--cc=syzkaller-bugs@googlegroups$(echo .)com \
--cc=yoshfuji@linux-ipv6$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox